agent-forge

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a non-official GitHub organization being recommended as a download/install source for agent packages (npx and ZIP downloads), which can host arbitrary code and is therefore a potentially untrusted distribution vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime fetching/execution of remote agent code and instructions (e.g., installing or downloading from https://github.com/lensetek/[agent-name] and https://github.com/lensetek/[agent-name]/archive/refs/heads/master.zip), and the auto-update feature requires pulling a remote SKILL.md which directly controls agent behavior.